#第 14 章：安全与权限管理

# 查看当前设备身份信息
cat ~/.openclaw/identity/device.json

# 查看设备认证状态
cat ~/.openclaw/identity/device-auth.json

# 查看凭证目录
ls -la ~/.openclaw/credentials/

# 方式 1：通过 CLI 命令添加凭证
openclaw credential add github-token \
  --type token \
  --value "ghp_xxxxxxxxxxxxxxxxxxxx" \
  --expires "2026-12-31"

# 方式 2：通过 JSON 文件手动添加
cat > ~/.openclaw/credentials/my-api-key.json << 'EOF'
{
  "type": "api-key",
  "service": "my-custom-service",
  "key": "sk-xxxxxxxxxxxxxxxxxx",
  "createdAt": "2026-03-06T10:00:00Z",
  "expiresAt": "2026-09-06T10:00:00Z",
  "scope": ["read", "write"],
  "notes": "用于自定义 API 集成"
}
EOF

# 设置正确的文件权限
chmod 600 ~/.openclaw/credentials/my-api-key.json

# 更新凭证（会自动备份旧文件）
openclaw credential update github-token \
  --value "ghp_new_token_value" \
  --expires "2027-06-30"

# 删除凭证
openclaw credential remove my-api-key

# 列出所有凭证（不显示实际值）
openclaw credential list

# 启用凭证加密
openclaw credential encrypt --all

# 仅加密指定凭证
openclaw credential encrypt github-token

# 查看加密状态
openclaw credential status

# 查看当前审批配置
cat ~/.openclaw/exec-approvals.json

# 查看某个 Skill 的权限声明
cat ~/.openclaw/workspace/skills/web-search/_meta.json | python3 -m json.tool

# 验证 Skill 权限是否合规（如果有 openclaw skill audit 命令）
openclaw skill audit web-search

# 检查当前 TLS 配置
openclaw config get security.tls

# 验证证书有效性
openssl x509 -in /etc/openclaw/certs/server.crt -noout -dates

# 在 Skill 脚本中引用环境变量（推荐）
#!/bin/bash
API_KEY="${TAVILY_API_KEY:?环境变量 TAVILY_API_KEY 未设置}"
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.tavily.com/search" \
  -d '{"query": "OpenClaw tutorial"}'

# 配置 Skill 运行时环境变量
# 在 _meta.json 中声明需要的环境变量
cat > ~/.openclaw/workspace/skills/my-skill/_meta.json << 'EOF'
{
  "name": "my-skill",
  "env": {
    "required": ["API_KEY", "API_SECRET"],
    "optional": ["DEBUG_MODE"]
  },
  "permissions": {
    "sandbox": "standard"
  }
}
EOF

# 验证 Vault 连接
export VAULT_TOKEN="hvs.xxxxxxxxxxxxxxxx"
export VAULT_ADDR="https://vault.example.com:8200"

# 测试连接
vault status

# 读取 OpenClaw 的 Secret
vault kv get secret/data/openclaw

# 扫描工作空间中的潜在敏感信息
grep -rn --include='*.md' --include='*.json' --include='*.yaml' \
  -E '(password|secret|token|api.?key)\s*[:=]\s*["\x27][^"\x27]{8,}' \
  ~/.openclaw/workspace/

# 检查 Git 历史中是否有敏感信息泄漏
git log --all --diff-filter=A --name-only --pretty=format: \
  | sort -u | grep -iE '(secret|credential|token|key)'

# 使用 .gitignore 排除敏感文件
cat ~/.openclaw/.gitignore

# 查看最近的审计日志
tail -5 ~/.openclaw/logs/config-audit.jsonl | python3 -m json.tool

# 查询所有被拒绝的命令执行
grep '"result":"denied"' ~/.openclaw/logs/config-audit.jsonl | \
  python3 -m json.tool

# 按事件类型统计
cat ~/.openclaw/logs/config-audit.jsonl | \
  python3 -c "
import json, sys
from collections import Counter
events = Counter()
for line in sys.stdin:
    try:
        obj = json.loads(line)
        events[obj.get('eventType', 'unknown')] += 1
    except: pass
for k, v in events.most_common():
    print(f'{v:>6}  {k}')
"

# 筛选特定时间范围的日志
grep '"2026-03-06T14' ~/.openclaw/logs/config-audit.jsonl | wc -l

# 查找凭证访问记录
grep '"credential.access"' ~/.openclaw/logs/config-audit.jsonl | \
  python3 -c "
import json, sys
for line in sys.stdin:
    obj = json.loads(line)
    print(f\"{obj['timestamp']}  {obj['actor']:20s}  {obj['credential']}\")
"

# 步骤 1：查看设备身份信息
cat ~/.openclaw/identity/device.json

# 步骤 2：列出所有凭证文件及权限
ls -la ~/.openclaw/credentials/

# 步骤 3：查看执行审批配置
cat ~/.openclaw/exec-approvals.json | python3 -m json.tool

# 步骤 4：检查审计日志最后 10 条记录
tail -10 ~/.openclaw/logs/config-audit.jsonl | python3 -m json.tool

# 步骤 5：确认文件权限是否满足安全要求
stat -c '%a %n' ~/.openclaw/credentials/* ~/.openclaw/identity/*

# 步骤 1：备份当前配置
cp ~/.openclaw/exec-approvals.json ~/.openclaw/exec-approvals.json.bak

# 步骤 2：添加自定义规则 — 允许 Python 脚本执行，但限制 pip 安装
cat ~/.openclaw/exec-approvals.json | python3 -c "
import json, sys
config = json.load(sys.stdin)
config['rules'].insert(-1, {
    'id': 'allow-python-exec',
    'pattern': '^python3?\\\\s+',
    'action': 'allow',
    'description': '允许执行 Python 脚本'
})
config['rules'].insert(-1, {
    'id': 'prompt-pip-install',
    'pattern': '^pip3?\\\\s+install',
    'action': 'prompt',
    'description': 'pip 安装需要人工确认'
})
print(json.dumps(config, indent=2, ensure_ascii=False))
" > /tmp/exec-approvals-new.json

# 步骤 3：验证 JSON 格式正确后替换
python3 -c "import json; json.load(open('/tmp/exec-approvals-new.json')); print('✅ JSON 格式正确')"
cp /tmp/exec-approvals-new.json ~/.openclaw/exec-approvals.json

# 步骤 4：验证新规则生效
cat ~/.openclaw/exec-approvals.json | python3 -m json.tool

# 步骤 1：创建练习 Skill 目录
mkdir -p ~/.openclaw/workspace/skills/security-demo

# 步骤 2：编写 _meta.json
cat > ~/.openclaw/workspace/skills/security-demo/_meta.json << 'EOF'
{
  "name": "security-demo",
  "version": "1.0.0",
  "permissions": {
    "network": {
      "outbound": ["httpbin.org"],
      "inbound": false
    },
    "filesystem": {
      "read": ["~/.openclaw/workspace/memory/"],
      "write": []
    },
    "commands": {
      "allowed": ["curl", "echo"],
      "denied": ["rm", "sudo", "chmod", "chown"]
    },
    "credentials": [],
    "sandbox": "strict"

  }
}
EOF

# 步骤 3：编写 SKILL.md
cat > ~/.openclaw/workspace/skills/security-demo/SKILL.md << 'EOF'
# security-demo

安全演示 Skill，用于验证权限隔离。

## 功能
- 发起 HTTP 请求到 httpbin.org（仅测试用途）
- 读取 memory 目录中的文件

## 权限
- 网络：仅允许访问 httpbin.org
- 文件系统：仅允许读取 memory/
- 沙箱模式：strict
EOF

# 步骤 4：审计权限声明
openclaw skill audit security-demo

# 步骤 1：统计各事件类型数量
cat ~/.openclaw/logs/config-audit.jsonl | \
  python3 -c "
import json, sys
from collections import Counter
c = Counter()
for line in sys.stdin:
    try:
        c[json.loads(line).get('eventType','?')] += 1
    except: pass
for k,v in c.most_common(10):
    print(f'{v:>6}  {k}')
"

# 步骤 2：找出所有被拒绝的操作
grep '"denied"' ~/.openclaw/logs/config-audit.jsonl | \
  python3 -c "
import json, sys
for line in sys.stdin:
    try:
        obj = json.loads(line)
        t = obj.get('timestamp','')
        cmd = obj.get('command','N/A')
        reason = obj.get('reason','')
        print(f'{t}  CMD: {cmd}  REASON: {reason}')
    except: pass
"

# 步骤 3：生成安全摘要报告
echo "=== 安全审计摘要 ==="
echo "日志总条数: $(wc -l < ~/.openclaw/logs/config-audit.jsonl)"
echo "拒绝操作数: $(grep -c '"denied"' ~/.openclaw/logs/config-audit.jsonl)"
echo "凭证访问数: $(grep -c 'credential.access' ~/.openclaw/logs/config-audit.jsonl)"
echo "最后活动时间: $(tail -1 ~/.openclaw/logs/config-audit.jsonl | python3 -c 'import json,sys;print(json.loads(sys.stdin.read()).get(\"timestamp\",\"N/A\"))')"

# 1. 检查设备身份文件是否完整
cat ~/.openclaw/identity/device.json

# 2. 如果损坏，需要重新初始化并重新添加所有凭证
openclaw init --reset-identity

# 3. 重新添加凭证
openclaw credential add github-token --type token --value "ghp_xxx"

# 使用备份恢复
cp ~/.openclaw/exec-approvals.json.bak ~/.openclaw/exec-approvals.json

# 或使用默认安全配置
openclaw config reset exec-approvals

# 方式 1：在旧设备上导出凭证（推荐迁移前操作）
openclaw credential export --output credentials-backup.enc

# 在新设备上导入
openclaw credential import --input credentials-backup.enc

# 方式 2：如果旧设备已不可用，手动重新添加凭证
openclaw credential add github-token   --type token   --value "ghp_your_new_token"

# 重新启用加密
openclaw credential encrypt --all

# 查看当前审批配置
cat ~/.openclaw/exec-approvals.json | python3 -m json.tool

# 检查被拒绝的命令是否匹配了 deny 规则
grep -n "deny" ~/.openclaw/exec-approvals.json

# 如需允许特定命令，添加到 allow 列表
# 编辑 exec-approvals.json，在 allow 数组中增加对应的命令模式
openclaw config edit exec-approvals

# 验证配置生效
openclaw doctor --check permissions

# 检查凭证目录和文件权限
ls -la ~/.openclaw/credentials/

# 修复权限：目录 700，文件 600
chmod 700 ~/.openclaw/credentials/
chmod 600 ~/.openclaw/credentials/*.json

# 验证修复结果
openclaw credential status